Fintech & regulatory

Compliance

How the current policy set maps to common compliance frameworks. Coverage is advisory: it is measured against the controls mapped in opserapol, not the full framework, and is not an audit artifact.

PCI DSS4.0100%

Payment Card Industry Data Security Standard

14 of 14 mapped controls covered

SOC 22017 TSC100%

AICPA Trust Services Criteria (Security)

6 of 6 mapped controls covered

CIS Kubernetes Benchmarkv1.8100%

Section 5 — policies enforceable at admission

16 of 16 mapped controls covered

NIST SP 800-53rev. 5100%

Security and privacy controls

13 of 13 mapped controls covered

ISO/IEC 270012022100%

Annex A controls

7 of 7 mapped controls covered

DORAEU 2022/2554100%

Digital Operational Resilience Act (EU financial entities)

5 of 5 mapped controls covered

DORA EU 2022/2554dora

5/5 (100%)

Control	Title	Mapped policies
Art. 9.2	Protection and prevention — ICT security policies and tools	30-Day Scan Age 90-Day Image Age ADD Command used instead of COPY Alpine Linux Package Manager (apk) in Image CAP_SYS_ADMIN capability added Container using read-write root filesystem Container with privilege escalation allowed Curl in Image Deployments should have at least one ingress Network Policy Deployments with externally exposed endpoints Docker CIS 4.1: Ensure That a User for the Container Has Been Created Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Docker CIS 4.7: Alert on Update Instruction Docker CIS 5.1 Ensure that, if applicable, an AppArmor Profile is enabled Docker CIS 5.15: Ensure that the host's process namespace is not shared Docker CIS 5.16: Ensure that the host's IPC namespace is not shared Docker CIS 5.19: Ensure mount propagation mode is not enabled Docker CIS 5.21: Ensure the default seccomp profile is not disabled Docker CIS 5.7: Ensure privileged ports are not mapped within containers Docker CIS 5.9 and 5.20: Ensure that the host's network namespace is not shared Emergency Deployment Annotation Environment Variable Contains Secret Fixable CVSS >= 6 and Privileged Insecure specified in CMD Iptables or nftables Executed in Privileged Container Kubernetes Dashboard Deployed Linux Group Add Execution Linux User Add Execution Login Binaries Mount Container Runtime Socket Mounting Sensitive Host Directories No CPU request or memory limit specified Pod Service Account Token Automatically Mounted Privileged Container Privileged Containers with Important and Critical Fixable CVEs Process with UID 0 Red Hat Package Manager Execution Red Hat Package Manager in Image Required Annotation: Email Required Annotation: Owner/Team Required Image Label Required Label: Owner/Team Secret Mounted as Environment Variable Secure Shell (ssh) Port Exposed Secure Shell (ssh) Port Exposed in Image Secure Shell Server (sshd) Execution Ubuntu Package Manager in Image Wget in Image
Art. 9.4(b)	Network and infrastructure segmentation	Deployments should have at least one ingress Network Policy Docker CIS 5.7: Ensure privileged ports are not mapped within containers iptables Execution Iptables or nftables Executed in Privileged Container Netcat Execution Detected Network Management Execution nmap Execution Remote File Copy Binary Execution Secure Shell Server (sshd) Execution
Art. 9.4(c)	Patching and updates of ICT systems	90-Day Image Age Apache Struts: CVE-2017-5638 Docker CIS 4.4: Ensure images are scanned and rebuilt to include security patches Fixable CVSS >= 6 and Privileged Fixable CVSS >= 7 Fixable Severity at least Important Images with no scans Log4Shell: log4j Remote Code Execution vulnerability Privileged Containers with Important and Critical Fixable CVEs Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol Spring4Shell (Spring Framework Remote Code Execution) and Spring Cloud Function vulnerabilities
Art. 10.1	Detection of anomalous activities and ICT incidents	Cryptocurrency Mining Process Execution Kubernetes Actions: Exec into Pod Kubernetes Actions: Port Forward to Pod OpenShift: Central Admin Secret Accessed OpenShift: Kubeadmin Secret Accessed OpenShift: Kubernetes Secret Accessed by an Impersonated User Unauthorized Network Flow Unauthorized Process Execution
Art. 28.1	ICT third-party risk — supply chain integrity	30-Day Scan Age 90-Day Image Age Images with no scans Latest tag Red Hat images must be signed by a Red Hat release key Required Annotation: Email Required Annotation: Owner/Team Required Label: Owner/Team Require Signed Images